Help: OpenClaw SAST keeps flagging our password hashing as 'weak crypto'.

Hi everyone! I'm pretty new to the SAST world and could use some help understanding a result. 😅

We're running OpenClaw SAST on our Node.js app. It keeps flagging our password hashing code as using 'weak crypto'. We're using `bcrypt`, which I thought was the recommended way? Here's the relevant part of our auth service:

```javascript
const bcrypt = require('bcrypt');
const saltRounds = 12;

async function hashPassword(plainTextPassword) {
return await bcrypt.hash(plainTextPassword, saltRounds);
}
```

The tool points to this line and says "Use of cryptographically weak hashing algorithm." Is this a false positive, or are we doing something wrong? I'd really appreciate a beginner-friendly explanation.

Thanks so much for your time!